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Mr. James A. Carew 

Chief Investigator 

Office of Securities Regulations 
157 Manchester Street 

Concord, New Hampshire 03301 


Dear Mr. Carew: 


By memorandum of May 16, 1988 you have presented two 
questions regarding the New Hampshire Right to Privacy Act, RSA 
chapter 359-C (1984), and its impact upon the administrative 
subpoena. You first ask whether the Office of Securities 
Regulations (OSR or Office) must ascertain and comply with "the 
requirements of similar laws of other states when issuing an 
administrative subpoena for documents" in the possession of 
out-of-state banks. Your second question pertains to the 
application of the statute's notice procedures when "the purpose 
of the subpoena is to ascertain the 'customer' or holder of the 
[bank] account". 


While answering your first question in the positive, we note 
that it raises a further issue as to the scope of RSA ch. 359-C 
(1984), which is addressed below. With respect to your second 
question, we conclude that OSR may ascertain the identity of a 
"customer" through the statute's subpoena process. 


RSA 359-C governs the disclosure of financial records of a 
"Customer" of a financial institution.! RSA 359-C:3,1IV; State 





lThe statute also regulates the disclosure of credit 
reports by credit reporting agencies. 
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v. Sheedy, 124 N.H. 738 (1984). The statute sets forth 
procedures which must be followed when a state agency such as 
OSR seeks access to such records. Specifically, your question 
involves RSA 359-C:8 (1984) which requires an administrative 
agency to (1) serve a copy of the subpoena to the customer, and 
(2) identify itself and its purpose in seeking the information. 
The customer may move to quash the subpoena within ten (10) days 
of service. RSA 359-C:8,I1(c) (1984). 


You have inquired as to whether OSR need make prior inquiry 
of the existence of statutes regulating bank disclosures when 
the office seeks records from a foreign institution, and whether 
compliance therewith is necessary. ? Assuming that OSR intends 
to pursue records through the issuance of a subpoena in New 
Hampshire, served in the other state, a preliminary question 
arises regarding OSR's power to subpoena witnesses and documents 
existing out of state. 


The Qffice is without authority to issue administrative 
subpoenas to financial institutions in other states. This is 
the case because the jurisdiction of administrative agencies is 
limited territorially as well as by subject matter, and they may 
not exercise their power extra-territorially. 2 Am.Jur.2d 
Administrative Law, §328. Since the administrative power of OSR 
does not extend outside of New Hampshire, a subpoena issued by 
the Office to an out-of-state financial institution need not be 
honored. OSR cannot mandate that such financial records be 
disclosed. Any provision of documents referenced in the 
subpoena need only be voluntary, since no legal sanction 
attaches. 


The question of voluntary compliance must be viewed in the 
context of any applicable privacy act which may well preclude 
such compliance. Protection of financial privacy through 
regulation is not uncommon, and at least three other states have 
enacted statutes substantially similar to RSA ch. 359-C 
(1984).3 While it is clear that OSR must comply with other 





2the Office of Securities Regulation is empowered to 
conduct “public or private investigations within or without the 
state...". RSA 421-B:22,I1(a)(Cum. Supp. 1987). 


3see, Cal. Gov't Code §§7460-7493 (1980, 1988 Cum. Pocket 
Part); Nev. Rev. Stat. §239A (1986); Or. Rev. Stat. 
§§192.550-.595 (1987); see also, 13 Uniform Laws Annotated, 


Information Practices Code, pp. 277-319. The Right to Financial 


Privacy Act of 1978, 12 U.S.C. §§341 et seq. is the analogous 


federal law. That statute re i i f 
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states' disclosure laws when seeking voluntary production of 
financial records, it is impossible to determine, without first 
reviewing the particular statute involved, whether a financial 
institution would be thereby prohibited from voluntary 
production. RSA 359-C:5,I (1984) for example, would appear to 
prohibit the voluntary production of records pursuant to an 
administrative subpoena issued by a foreign state agency because 
the subpoena is not "authorized by [New Hampshire] law". RSA 
359-C:8,I (1984). A New’Hampshire bank thus may not provide the 
records on a voluntary basis. Therefore the answer to your 
first question is that OSR must indeed ascertain and comply with 
other states disclosure laws, but the terms of the statutes 
which do exist may well preclude disclosure to OSR. 


Assuming however that the other state does not statutorily 
protect the privacy of bank records or otherwise inhibit its 
banks from disclosing the requested records, a further question 
arises as to whether OSR must comply with the provisions of RSA 
ch. 359-C (1984) when making such a voluntary request. In other 
words, does the chapter "follow" a New Hampshire state agency 
when it operates extra-jurisdictionally? The question is of 
some consequence due to the statute's imposition of criminal 
penalties upon one who either "knowingly violates" it, or 
"attempts to induce" its violation. RSA 359-C:12,I1,II (1984). 


Because RSA ch. 359-C (1984) does not expressly indicate its 
territorial application it is not immediately clear whether the 
legislature intended that state agencies comply with its 
provisions when seeking out-of-state records. That 
determination must be made on the basis of the language of the 
statute, as well as its expressed purpose. See, State Employees 
Ass'n v. Board of Trustees, 120 N.H. 272, 273 (1980); 2 
Sutherland, Statutory Constriction, §20.13 (1986). 


The prescriptions of RSA ch. 359-C (1984) are directed at 
financial institutions and governmental agencies alike. The 
statute does not purport to bind however, those banks operating 
in other states. Further, its method of restricting state 
agencies, through the simultaneous notice and quash procedures, 
is rendered irrelevant when the agency seeks records ona 
voluntary basis from an out of state bank. Therefore, while RSA 
ch. 359-C (1984) is silent as to its territorial scope, it would 
be illogical to apply the notice procedues of §8 in those 
circumstances where use of the administrative subpoena is 
jurisdictionally foreclosed. See, State v. Howland, 125 N.H. 
497, 502 (1984). 


Nor does the statute's purpose, expressed as the 
"protect[ion] [of] the confidential relationship between 
financial institutions...and their customer", RSA 359-C:2,II 
(1984) conflict with this interpretation since there is no 
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suggestion that the legislature intended either to protect 
non-residents or to bind out of state banks. Finally, this 
constructon avoids the potential criminalization of OSR's 
receipt of information from other states' agencies as well as 
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established in RSA ch. 359-C (1984) when it seeks bank records 
of out-of-state residents from institutions in jurisdiction 
which do not regulate their provision. 


In your second question, you ask "who, if anyone, this 
office should notify [pursuant to RSA 359-C:8,I1,(a)(1984)] if 
the purpose of the subpoena is to ascertain the 'customer', or 
holder of the account". As I understand it, your question 
implies that while the office has certain information relative 
to a particular bank account, it possesses neither a business 
nor a personal identifier. In such a case, compliance with the 
simultaneous service provision of RSA 359-C:8,I would be 
impossible. In this event, OSR should use its reasonable 
efforts to obtain identifying information from available 
sources. The failure of such efforts however, should not 
preclude issuance of the subpoena. We find no basis in the 
statute upon which to conclude that the purpose you indicate is 
not legitimate. In fact, at least one other Attorney General 
has similarly opined that a comparable statutory provision did 
not prohibit an institution from releasing a customer's name and 
account number to a district attorney who had neither a search 
warrant nor other legal process. See, 65 Cal. Ops. Atty. Gen., 
4, 1-7-82.4 Accordingly, OSR need not notify anyone if it is 
unable reasonably to ascertain the customer's identity. The 
office should however, resume compliance if, after learning the 
customer's identity, it then seeks to obtain additional records. 


I trust that the foregoing has been of some assistance to 
you. Please do not hesitate to contact me should you have 
further questions. 


Sincerely, 


“TA etter Q. Cal 


Monica A. Ciolfi 
MAC/pad Attorney 
O-88-017 


4a further analogy is found at §7609(c)(2)(A) of the 
Internal Revenue Code. Thus, tax privacy provisions do not 
cover those summonses issued solely to determine the identity of 
a person with a number account. 


